First go to Settings > Channels > Messenger > Install and open Secure the Messenger with Identity Verification.

Then choose how you installed your Messenger (with an NPM package or with an integration).

For Code snippet installations, you'll need to generate an HMAC on your server for each logged-in user and send it to Intercom.

First, choose how you want to uniquely identify your users via User ID or Email.

Then choose the server-side language or framework you're using to get your code to generate an HMAC for your app.

Everywhere you load user data and have a window.intercomSettings code snippet, add a new attribute called user_hash and assign the HMAC code to it.

We offer an updated code snippet which includes HMAC value as a parameter sent to the Intercom Messenger. Simply click Copy code to use it.

Once you’ve set up Identity Verification and started sending user_hashes for each user, check the installation is working as expected.

Click on Check installation. This button will display a table of the domains where the Messenger has been found, as well as their Identity Verification status. A green tick indicates success, and a warning triangle indicates that the Messenger was not found with the correct Identity Verification settings.

You can also use our hash checker to verify that the user hash values you're sending over to Intercom are correct, ensuring that Identity Verification will work correctly. Here, you can verify what the expected user hash is based on user_id or email (if you're not using user_id's).

If you’ve correctly modified your Messenger code and see no errors, you can now enforce Identity Verification by toggling on the option "Enforce Identity Verification for messenger" and clicking Enforce. This may take 5-10 seconds to activate.

Once enforced, any requests without user hashes will be rejected, preventing impersonation of your users via the Messenger.

Similarly to the Web installation, you'll find the toggle for iOS, Android & React Native under Install for mobile:

Then retrieve the Identity Verification secret key and store it in a secure place on your server.

Now follow our mobile SDK guides for the platform you’re using:

Once you have tested that your Messenger is working as expected in your app, turn off Identity Verification and publish the new Identity Verification-enabled version on the App Store. When you reach a high level of adoption, toggle Identity Verification on, which will then start enforcing it for all versions of your app.

You can turn Identity Verification off at any time by navigating to Settings > Channels > Messenger > Install and scrolling down to the final step of Secure the messenger with Identity Verification on your chosen platform setup to toggle off "Enforce Identity Verification for messenger". This can be useful while you’re developing.

We can rotate your identity verification secrets for you from our end, this cannot be done from your own workspace. To perform this rotation we will need you to contact us directly and to do the following:

There will be no downtime, however, during the completion of steps 2-5 your users will be able to use the Messenger without identity verification enabled.